Improving Web Application Security: Threats and - CGISecurity

802 Improving Web Application Security: Threats and Countermeasures●Installing URLScan 2.0 without running IISLockdown: To install URLScanwithout running IISLockdown, you need to manually extract it from the IISLockdown Tool. First you need to save IISLockd.exe to a directory. Then to extractthe URLScan setup files, run the following command at the command line fromthe directory where you installed IISLockd.exe:iislockd.exe /q /c●●This unpacks URLScan.exe which is the URLScan installation program.For more information, refer to Microsoft Knowledge Base article 315522, “How To:Extract the URLScan Tool and Lockdown Template Files from the IIS LockdownTool.”Installing URLScan 2.5: URLScan 2.5 is currently the latest version of URLScan. Ifyou want to install URLScan 2.5, you first need URLScan 1.0 or URLScan 2.0.For more information, refer to Microsoft Knowledge Base article 307608, “INFO:Availability of URLScan Version 2.5 Security Tool.”Default installation directory: The URLScan files including Urlscan.dll,URLScan.ini and URLScan logs are stored in%windir%\system32\inetsrv\urlscan. URLScan.dll is the filter. You useURLScan.ini to configure the way it works.Log FilesURLScan creates log files that record rejected requests. Log files are located in thefollowing folder:%windir%\system32\inetsrv\urlscanLog files are named using the following convention: URLScan.log.Removing URLScanYou remove URLScan manually by using the ISAPI filters page of the Web serverproperties dialog in Internet Services ManagerConfiguring URLScanTo configure URLScan to determine which requests should be rejected, you useURLScan.ini. This is located in the following folder:%windir%\system32\inetsrv\urlscanFor more information on how to modify the various sections in URLScan.ini, referto Microsoft Knowledge Base article 815155 “How To: Configure URLScan to ProtectASP.NET Web Applications.”